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Abstract. We consider redundant binary joint digital expansions of integer vectors. The 
redundancy is used to minimize the Hamming weight, i.e., the number of nonzero digit vectors. 
This leads to efficient linear combination algorithms in abelian groups, which are for instance 
used in elliptic curve cryptography. 

If the digit set is a set of contiguous integers containing the zero, a special syntactical 
condition is known to minimize the weight. We analyze the optimal weight of all non-negative 
integer vectors with maximum entry less than N. The expectation and the variance are given 
with a main term and a periodic fluctuation in the second order term. Finally, we prove 
asymptotic normality. 



1. Introduction 

We deal with integer representations of vectors of integers called joint representations. 

Definition 1.1. For base 2, dimension d and a digit set D C Z the dimension-d joint repre- 
sentation of a vector n £ Z d is a word (el...Eq) with E{ £ D d and n — value(eL . . . eg) with 

value(e L ■ • • £o) = Z)i=o £ i 2 '- 

Such representations can be used for computing a linear combination m\P\ + ■ • • + widPd of 
points Pi of an elliptic curve, or more generally an abelian group (cf. [7]). For every nonzero digit 
£j an elliptic curve addition is performed. Since these are expensive, we want to minimize the 
number of nonzero digits. On the other side every nonzero column vector e £ D d corresponds to 
a precomputed point. The number of doublings corresponds to the length of the expansion. Each 
Ei in the expansion (el ■ ■ ■ £o) is called a column vector of the expansion. 

Example 1.1. A dimension-3 digit expansion with digit set {0, 1,2} is 




It is a representation of (11,4, 17) T , because 

/n\ /ion\ /i\ M fi\ fi\ 

4 = value 0020 = 2 3 + 2 2 + 2 2 1 + 2°. 

W \2ooiy W W W W 

Definition 1.2. The Hamming weight h{ei, . . . £q) °f a digit expansion (si . . . £q) is the number 
of nonzero columns Ei =/= 0. 

The Hamming weight of an integer depends on the representation we use. For example, we have 
two representations of 3 = value(3) = value(ll) with Hamming weight /i(3) = 1 and h(ll) = 2. 
But since we always use a specific digit expansion in this paper, we just write h(n) for the Hamming 
weight of this digit expansion. 

This specific digit expansion is the asymmetric joint sparse form (short AJSF) as presented by 
Hcuberger and Muir in (S]- The digit set of this representation is D^ u — {a £ Z | I < a < u}. It 
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is a dimension-d joint integer representation in base 2. In [5] it has been shown that the AJSF 
is colexicographically minimal and has minimal Hamming weight among all representations with 
this digit set Di iU . 

For prior results on syntactically defined optimal digit expansions we refer to [5] and the refer- 
ences therein. The special case of Theorem [I] in dimension 2 and digit set D-\ i has been shown 
in|3]. 

We compute the expected value, the variance and the asymptotic distribution of the Hamming 
weight of the AJSF. The definitions and algorithms of the AJSF are recalled in Section [2] In 
Section [3] we construct a transducer from this algorithm. In Theorem [4] we explicitly describe this 
transducer to compute the Hamming weight. In Section [4] we prove the following Theorem [l] about 
the asymptotic normal distribution of the the Hamming weight. We use the discrete probability 
space {n G Z | < n < N} d with uniform distribution as a probabilistic model, in contrast to 
[5] where in the "full-block-length" analysis only residue classes modulo powers of 2 have been 
considered. 

Theorem 1. The Hamming weight h(mi, . . . , mj) of the AJSF of an integer vector (mi, . . . , md) T 
over the digit set Di tU in dimension d with equidistribution of all vectors (mi, . . . , rrid) T with 
< m, < N for an integer N is asymptotically normally distributed. There exist constants e^ u .d, 
vi, u ,d € K and S > depending on u, I and d such that the expected value is 

e ; , M log 2 N + *i(log 2 N) + 0{N- 5 log N) 

and the variance is 

vi,u,d log 2 N - * 2 (log 2 N) + <3/ 2 (log 2 N) + 0(N- 5 log 2 N), 
where ^i and 4' 2 are continuous, 1-periodic functions on R. In particular, we have 
m (h(m 1 ,..., md )-e l , u , d \o g2 N <x \ r e ^ dy + (D ( 1 



y y/v hu4 \0g 2 N J J-oo V ^OgN 

for all For d = 1, we have 

1 , (3-A)A 

ei, u ,i = : — — r and v Lu ,i = 



where 



X = 



1 + A w (w-l + A) 3 
2(u- 1 + 1) -(-!)' -(-l) u 



2 W 

General formulae for e^ Ut d for d — 2 are given in [5, Table 3]. For d € {1, 2, 3, 4}, general formulae 
for ei^ u ,d and u/ iU .d are given in ^ . 

In the last Section [5] we further investigate the error term of the expected value and the 
variance of the Hamming weight in the case of the width-u; nonadjacent form. In this case 
S = log 2 + ^73") f° r sufficiently large w, see Theorem |sj 

2. Preliminaries 

First, we define some properties of the digit set. 

Definition 2.1. Let Di tU = {a G Z | / < a < u} for I < and u > 1 be the digit set. It contains 
u — I + 1 digits. The integer w is the unique integer s.t. 2 W ^ 1 < u — I + 1 < 2 W . 

We know w > 2 because 0,1 € D^ u . The digit set contains at least a complete set of residues 
modulo 2 U, ~ 1 . However, some residues modulo 2 W are not contained. Thus we define the following 
two sets: 

Definition 2.2. Let unique(D;.„) = {a £ Di iU | u — 2 W ~ 1 < a < I + 2 W ~ 1 } and nonunique(Z);.„) = 
Di^u \ unique(Z?i jtl ) be the sets which contain the unique respectively non-unique residues modulo 
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Without loss of generality we can restrict I to be greater than — 2 W ~ 1 . Otherwise we would take 
the digit set Z)_ Ui _; where we have — 2 W ~ 1 < —u < —1. Then every representation of a vector n 
of integers with digit set Di tU would correspond to a representation of — n with digit set D_ U) _; 
by changing the sign of each digit. Thereby the weight of the representation does not change. 

We also consider the with-w nonadjacent form (cf. j6j[T]). 

Definition 2.3. The width-w nonadjacent form (short w-NAF) of an integer n is a radix-2 
representation (el ■ ■ ■ £o) of n with the digit set D w := {0, ±1, ±3, . . . , ±(2 W ~ 1 — 3), ±(2 tu_1 — 1)} 
and the following property: 

If Ei ^ 0, then s i+ i = . . . = £ l+w -\ = 0. 

The AJSF is a generalization of the w-NAF. For dimension one only odd digits and zero are 
used in the AJSF. After a nonzero digit there are w — 1 zeros. Thus, for I = — 2 W ~ 1 + 1 and 
u = 2 W ~ 1 — 1 we obtain the w-NAF. This follows from Theorem 6.1 in [S]. 

It is known that the w-NAF representation exists and is unique for every integer (cf. [5]). 

In [5] Heuberger and Muir introduce the AJSF, provide an algorithm to compute it and prove 
its minimality concerning colexicographic order and Hamming weight. 

Theorem 2 ([5]). Algorithm 3 in [5] computes the AJSF in dimension d for an integer vector n. 
The AJSF has minimal Hamming weight among all digit expansions of an integer vector n with 
digit set D^ u . 

We present a slightly modified version of Algorithm 3 in |S] as Algorithm [T] The modification 
takes into account that we are only interested in the weight. Furthermore, those iterations of the 
while loop where the output is already predetermined are now skipped. 

For simplicity we write n + a, for a vector n and an integer a, to denote that we add a to every 
coordinate of the vector n. 

The if branch in line [3] of Algorithm [T] makes the digit at the current position a zero column 
if possible. If this is not possible, the else branch in line [6] chooses the smallest digit in each 
component which is congruent to the input. In the inner if and else branches the algorithm 
checks if we should change any non-unique digits. In the if statement in line [12] we check whether 
we can make the (w — l)-st digit after the current digit zero. If this is not possible we check in 



the else statement in line 17 whether we can increase the redundancy at the (w — l)-st digit after 
the current digit by changing any non-unique digits at the current position. 

In the case of dimension one we can further simplify Algorithm]!] If /unique 7^ 0, then / n onunique = 
0. Thus the else branch in line 17 will not be processed. Algorithm [2] is the simplified version for 
dimension one. 



3. Construction of the transducers 

In this section we describe the construction of the transducers for the computation of the 
Hamming weight. We start with the easiest case, the w-NAF. We will then modify the ideas 
to deal with the asymmetric case of .D; ^-expansions in dimension 1. We finally generalize the 
approach to the ci-dimensional Z); iU -expansions. 

All transducers and automata take a (joint) binary expansion as input and read from right to 
left. The output of the transducers is a sequence of and 1. Then the computed Hamming weight 
is the number of 1 in this output. 

Lemma 1. Let w > 2. The transducer in Figure [7] calculates the weight h(n) of the w-NAF of an 
integer n. 

Proof. Let n — value(n; . . . n ) with rij G {0,1} be the standard binary expansion of n and 
(ek ■ ■ ■ £o) be the w-NAF representation of n. If n = mod 2, then £o = and we stay in the 
initial state. Otherwise £q ^ and the weight h(eo) = 1. Since we have a w-NAF representation, 
the next w — 1 digits e\ = £2 = • • • = £ w -i = 0, no matter what the corresponding nj, j = 
1, . . . , w — 1 are. The sign of the digit £0 depends on n w _\ mod 2. If n w -\ = mod 2, then 
Eq > and we go to state w with the next input n ~Jf° with carry zero. If n w _i = 1 mod 2, then 
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Algorithm 1 Algorithm to compute the weight of the AJSF with digit set D^ u 

Input: A vector of integers n G Z d , integers I < 0, u > 0, n > if I = 
Output: Weight h(n) 



1 

2 
3 
4 
5 
6 
7: 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17: 
18 
19 
20 
21 
22 
23 
24 
25 
26 



ft = 

while n^Odo 

if n = mod 2 then 

a = 0, h = h + 
m=f 
else 

a = Z + ((n-Z) mod 2™- 1 ) 
/i = ft + 1 

m = ^ 

Unique = {j e {1, 2, . . . , d} | Oj G unique(A,u)} 
-^nonunique = {j e {1, 2, . . . , d} | aj e nonunique(A.u)} 
if m,j = mod 2 for all j € /unique then 
for j G /nonunique such that m,j is odd do 
= a, + 2 W ' 1 
rrij — m,j — 1 
end for 
else 

for j G /nonunique such that uij = u + 1 mod 2 W ~ 1 do 
= Oj + 2 1 "- 1 

m 

end for 
end if 
end if 
n = m 
end while 
return h 



J — 3 



Algorithm 2 Algorithm to compute the weight of the AJSF with digit set D^ u in dimension one 



Input: Integers n, I < 0, u > 0, n > if I 
Output: h{n) 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17: 
18 



h = 

while n^Odo 

if n = mod 2 then 

a = 
ft = ft + 
m = | 
else 

a = Z + ((n-/)mod 2™- 1 ) 
ft = ft + 1 

_ n-o 

if 77i ee 1 mod 2 and (n - I) mod 2 1 "- 1 < u - I - 2 W ^ then 
a = a + 2 w - 1 
m = m — 1 
end if 
end if 
n = m 
end while 
return ft 
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FIGURE 1. Transducer to compute the Hamming weight of a u>-NAF representation. 

Sq < and we therefore have a carry of 1 and go to state w + 1. There, reading an input of one 
and having a carry of one results in the same outcome as reading a zero, but the carry remains 
one. Reading an input of zero with carry one is then equivalent to reading an input of one with a 
carry of zero, so we are in state 1 again. □ 

In the next step we construct a transducer for the Hamming weight of the AJSF in dimension 
one. Therefore we need the following automaton to compare integers. 

Lemma 2. Automaton^ in Figure^ accepts the input of three integers a,b,c if and only if 
a + b < c. The binary expansions of a, b and c must have the same length where leading zeros are 
allowed. 

Proof. The states are (s,t) with s, t 6 {0,1}. The label s signifies the carry of the addition 
a + b which still has to be processed. The label t corresponds to the truth value of the expression 
(a + b) mod 2 l > c mod 2 l where i is the number of read digits up to now. So the automaton 
accepts the input if it stops in state (0, 0) where there is no carry anymore and a + b > c is false. 
The initial state is (0,0). 

Therefore there is a path from (0,0) to (s,i) in Automaton [2] with input label 

oti-i . . . a \ 

A) 

7i-i • • -70/ 
if and only if 

value(a,;_i . . . a ) + value(/?j_i . . . /?o) 
S = [ * _ 

and t — [(value(ai_i . . . a ) + value(/3 i _ 1 . . . /3 )) mod 2 1 > value(7 i _ 1 . . . 7 )] . Here we use Iver- 
son's notation, that is [expression] is 1 if expression is true and else. From this the rules for 

(q,/9,7) t 

the transitions follow. There is a transition (s,t) — — > (s',t r ) if and only if s' = 

t! = [(a + /3 + s) mod 2 > 7 - t]. 

□ 

Theorem 3. There exists a transducer with input and output alphabet {0, 1}, less than Aw — 2 
states where one state is initial and final to compute the Hamming weight of the AJSF from the 
binary expansion of an integer. 

Proof. We construct a transducer, doing the same calculation as Algorithm [2] It will look similar 
to the transducer in Figure [l] We start at some state 0. Then there is some vertical block of 
states with w — 1 rows and states (0, 0)j, (l,0)j, (0, l)j and (1, l)i for each row i = 1,... , w — 1. 
After this block we either go back to state 0, or to a similar state 1, or again to the block of states 



and 
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(0,0, Of ,(0,0. if 
(0,1, if, (1,0, If 



(0,1, Of, (1,0, Of 
(0,1, If, (1,0, If 
(0,0, of 



(l,l,lf 

(i,i,of 




(o,o,of 

(0,0, If 



(1,0, If, (0,1, If 
(1,0, Of ,(0,1, of 

(l,l,lf 



(1,1, If, (1,1, of 
(1,0, Of ,(0,1, of 



FIGURE 2. Automaton [2] to compare three integers a, b and c, accepts if a + b < 



(see Figure [3]). We call the states and 1 the looping states. Their labels signify the carry which 
is to be processed. The state is also the final state. 

The block of states corresponds to the if statement in line [TT] in Algorithm [2] In this line we 
have to check the inequality (n — l) mod 2 t0 ~ 1 < u — I — 2 W ~ 1 . A first step to this aim is to compare 
n + I < u with I :— —I and u := u — I — 2 W ~ 1 . Therefore we use Automaton^ 

Next we examine the binary expansions of u and I. Since we have assumed that I > — 2 W , we 
know that the length of the binary expansion of I is at most w — 1. Furthermore — 1 < u < 2 W . 
In the case u = — 1 the set nonunique(Z?i !tl ) is empty and we have no choices for the digits. We 
will return to this case later. Then the length of the binary expansion of u is at most w — 1. Let 
(l w —2 ■ ■ ■ lo) and (u w ~2 ■ ■ ■ uo) be the binary expansions of / respectively it. 

Now we can verify n + I mod 2 W ~ 1 < u by checking the label t of the state (s, t) after reading 
w — 1 digits from the binary expansion of (n, I, u) T in Automaton^ If t = 0, then the inequality 
is true, otherwise it is false. Since the length of u is less than or equal w — 1 there are no digits of 
u left. Only a possible carry of the addition n + 1 is left. This carry is the label s of the current 
state (s, t). Therefore in fact we have checked n + l mod 2 W ~ 1 < u. To ensure that we read exactly 
w — 1 digits, the transducer in Figure [3] has w — 1 copies of the four states of Automaton [2] The 
transitions start in a state of the z-th copy and go to an appropriate state of the (i + l)-th copy 
while reading the z-th digit of the expansion. 

In the if statement in line [TT] in Algorithm [2] we have to check the other condition m = 1 
mod 2 too. Let (s,t) w ^ 1 be the current state at the end of the block of states. We know that 

rn = mod 2 ^ therefore the least significant digit of m is simply the next digit of the 

addition n + l. Since there are no digits of the expansion of / left, we only have to look at the next 
digit e of n and consider the carry s. Thus we have m = s + e mod 2. 

If the inequality of the if statement is satisfied, that is if t = 0, then whatever digit e we read 
next, the transducer starts from a looping state again. If m is even, then the next written digit is a 
zero anyway. If m is odd, we can change the digit in the representation (because it is non-unique) 
and m becomes even too. We only have to remember the carry. If s = or s = 1 and we read 
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e = then there will be no carry propagation and we continue with state 0. If s = 1 and we read 
£ = 1, then there is a carry propagation and we start at state 1. 

If the inequality is not satisfied, that is if t = 1, and m = s + e mod 2 is odd, then we have 
to start with the w — 1 transitions of Automaton [2] immediately. If m is even however, then 
the transducer starts from a looping state again. In both cases we have to consider the carry 
propagation as well. 

At state s € {0, 1} we stay in state s as long as we read s. If we read 1 — s we start with the 
W — 1 transitions of Automaton [2j 

For the case u = —1 the set nonunique(Z); „) = 0. Therefore in each state t — 1 and the initial 
state of Automaton [2] has to be (0, 1). Let (u w ^2 ■ ■ - Uo) = (0 1 " -1 ). Then we have a transition 
from s to (s',i')i with input label 1 — s if and only if there is a transition from (s, 1) to (s',t') 
with input label (1 — s, Iq, uq) t in Automaton [2] 

To summarize we have the following transitions in the transducer in Figure [3] for s, s', t, t', 
e £ {0, 1} and i G {1, . . . ,w — 2}: 

e|0 

• S 5- ,S II s = s 

• s ^> (s',i')i if s and (s, [« = -1]) > (s',t') is a transition in Automaton 2 

• (s,t)i -^H> (s 1 ,t')i + i if (s,i) < * £ ''""'' > > (s',£') is a transition in Automaton [2] 

• (s, ^> s' if £ = or e + s = mod 2, and s' = [^J 

• (s,t) w -i (s',<')i if t = 1, e + s= l mod 2 and (s, [u = —1]) ^' l °' u °^ > (s',t') is a 
transition in Automaton [21 



We note that there is only one accessible state in the first row, because the transitions 




{s,t)i and 1 — > (s,t)i have both the same target state. This target state depends on I and u. 

Finally, we restrict the transducer to the states which are actually accessible from the initial 
state. 

Now we can describe the last state of the path with input label (sl ■ ■ ■ £o), a binary expansion. 
The following statements can be easily proved by induction. We define sequences ki, Si, ti for 
i > and a,, /j for i > 1, with s — 0, t — 1. For u > these sequences satisfy the following 
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recursions for i > 1: 



fi = ko H h fcj 



fe- 


Yw-2 ■ 


■ -e/i+w-i) 


= (O^l) or (0 fe )} 


if Si 


= u = 


o, 


fe- 


Yw-2 ■ 


■ ■ Sfi+w-l) 


= (l k ) or (0 fc )} 


if Sj 


= 1, u 


= 


k- 


Yw-2 ■ 


■ ■ Sfi+w-l) 


= (o k )} 


if Sj 


= 0, ti 


= 1 


k- 


Yw-2 ■ 


■ ■ £fi+w-i) 


= (l fe )} 


if St 


= ti = 


1, 




l)(w 


"1), 











ti = 



value(e /i+M _2 . . . £/,+il) + I 
2w-i 

^value(ey. +u ,_ 2 ■ • + H m °d 2 11 

-/ + (value( £/i+1 _i . . . £/,+il) + f mod 2 k > +VJ - 1 ) 



> u 



The states (sj, are the states in the last row of the path. The integers fc, count how often 

we circle in a looping state after the state (si,ti) w -\. The numbers fi are the positions of the 
nonzeros in the AJSF and is the digit at position fi. 

Then we have 

value(e /i+tu _ 2 • • .£/ !+ il) = a t + 2 w ~ 1 s l (l - [s { =lAU = A £f i+w -i = 0]). 

There is a path from to (s,t)j with input label (sl . . .Eq) if and only if. j = L — fi + 1, 

fi < L < fi + w — 2 and 

value(e_L ■ ■ ■ £ /«+il) + value(^_i . . . Iq) 



2J 



t 



[(value(e L . . . £y. +1 l) + value(? :) _i . . . l )) mod 2 J > value(uj 



There is a path from to s with input label (e^ ■ ■ ■ £o) if an d only if fi 
and s — Si or s = 0, = 1 and (e^ . . . Sf i+w -\) = (o L -fi- w + 2 y 
For u — — 1 the only difference is t j = 1 and t = 1. 



-l • ■ - wo)] • 
w — I < L < f i+ i 



Example 3.1. For / = —3 and u = 11 we have w = 4, I = (011)2 and u — u~ I — 2 b 
The transducer can be seen in Figure [4] where all non-accessible states are gray. 

Now we generalize this transducer to arbitrary dimension d. 



1 

□ 

(no) 2 . 



Theorem 4. There exists a transducer to compute the Hamming weight of the AJSF for the joint 
binary expansion of a d-dimensional vector of integers as input. It has one state which is initial 
and final, input and output alphabet {0, 1} and less than 8 d w states. 
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Proof. We construct a transducer calculating the weight of AJSF. In order to explain the structure 
of this transducer, we first consider a provisional transducer implementing a simpler version of the 
Algorithm [l] which omits the else branch in line 17 see also the algorithm on page 306 of [S]. The 



resulting provisional transducer is similar to the transducer in Figure [3] 

For every vector s £ {0, l} d there is a state. These states are called looping states. The vector 
s signifies the carry at each coordinate. The state (0, . . . , 0) T is the initial state. Furthermore 
there is a block of states. The states inside the block have the labels (s,t)i where s, t £ {0, l} d , 
and i is the row in the block. The coordinates of s and t have the same meaning as in the proof 
of Theorem [3] that is s is the carry of the addition n + I and t signifies whether the digit is in 
nonunique(L>;.„) or not. 

If s £ {0, l} d is a looping state, then there is a loop with label s | at this state. Because if we 
read e = s, then we have e + s = mod 2, the output is and the carry propagates to the next 
step. If we read e ^ s, then we start with the w — 1 transitions of Automaton [2] in Figure [2] in each 
coordinate. These w — 1 transitions are processed independently for every coordinate. Therefore 
we need 4 d states in each row and w — 1 rows to process exactly w — 1 transitions of Automaton [2] 

After the last row of the block of states we either go back to a looping state or again start with 
the block of states immediately. Let (s, t) w -i be the current state in the last row and e the next 
input digit. As in the one dimensional case we have m = e + s mod 2. If for every coordinate j, 



tj = 1 implies m, is even, then we have to process the if branch in line 12 We write this condition 



as the scalar product t ■ (s + e mod 2) = 0. In this case the next output digit will be zero and we 
go on to a looping state s' where the new carry is s' = [^^J 

If t ■ (s + £ mod 2) = does not hold, then we would have to process the else branch in line 17 
But since we skip this part for now we simply have to restart the transducer with the input m 
in the case t ■ (s + e mod 2) > 0. We know that m is the original next input e plus the carry s. 
In this case s ^ e, otherwise t ■ (s + e mod 2) > would be false. Therefore there is a transition 

s ^— ¥ (s',t')i in this transducer. This ensures that, when restarting the transducer with input m, 

we immediately go on to the state (s',t')i. Hence we have a transition (s, t) w -i — ^ >■ (s',t')i in 
the provisional transducer. 

Altogether, for s, s', t, t' £ {0, l} d , i £ {1, ... w - 2}, j £ {1 ... d} and e £ {0, l} rf , we have the 
following transitions in this provisional transducer: 

e|0 

• S > S II £ = s 

• s -^i> (s',t')i if £ 5^ s and Vj : (sj, [u — —1]) <Ej ' "' — > (s^t'j) is a transition in 
Automaton [2] 

• (s,t)i ^> (s',t') i+ i if Vj : (sj,tj) ^ : "'""'" > > (Sj-,t'-) is a transition in Automaton 2 

• (s, £)„,_! s' if t ■ (s + £ mod 2) = and s' = [^rJ 

• (s,t) u ,_ 1 ^> (s',/ 7 )! if t ■ (s + e mod 2) > and s (s',t')i is a transition in this 
transducer. 

This transducer does the same as Algorithm [l] without the else branch in line 17 In the case 



u = — 1 we are finished, because in the else branch nothing is done. Otherwise we must consider 
the else statement. 

Let (s, t) w _i be the current state in the last row and e be the next input digit. To process 
the else branch, t ■ (s + e mod 2) > must hold in the state (s,t) w _i. Otherwise we would 
process the if branch. First let us examine one coordinate j. If tj = 1 nothing is done in the 
else branch, because the digit at this coordinate is unique. If tj = 0, we have to decide whether 
u + 1 mod 2 w ~ l . Here m, mod 2 t0 ~ 1 corresponds to the next w — 1 input digits plus the 



rn 



carry Sj from the current state (s,t) t0 _i. So we just have to compare the input letters plus the 
carry with the binary expansion of u + 1 mod 2 W ~ 1 or, equivalently, we compare n%j — I mod 2 W ~ 1 
with v = u — I + 1 mod 2 W ^ 1 . If they are not the same at some point, then we just go on like we 
did in the provisional transducer. 

If they are the same, we have to process the else branch. There we would have taken rrij — 1 
as the next input of the algorithm instead of rrij . Therefore we have to decide where we would 
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be in the provisional transducer, when starting in (s,t) w _i and the input is the original input 
minus one. This case only happens if originally the next nonzero digit is unique, but changing the 
current digit ensures that the next nonzero digit is non-unique. Nevertheless the next digit will 
not be zero, since this is the case when the if branch is processed. Therefore we would start in 
(s, i) w -\ with original input minus one and immediately go to the block of states again. Otherwise 
the next digit would be zero. Thus after w — 1 transitions we are again in a state (s 1 , t') w _i in the 
last row. Since the next digit is non-unique, we have t'j — 0. 

To determine the value of s' we have to decide whether there is a carry at position w — 1 in the 
addition of rrij - 1 and I. We have m 3 - 1 mod 2 1 "- 1 =u+ k2 w - 1 for k <= Z. Since < u < 2 W - 1, 
we have k G {0, —1}. Then the carry is 

(mj - 1) mod 2 W ^ + Z mod 2 W ^ 
2w-i 

u + l + k2 w - 1 
2w-i 

= 1 + fc, 

because 2 W ~ 1 < u + I < 2 W . Therefore we have 

, _ f if u> 2 W ~ 1 , 
Sj ~ \l ifu<2 w - 1 . 

As a result the state (s',t') w -i where we would be in the provisional transducer has 

([u<2 w ~ 1 ] ,0) 

in the j-th coordinate. 

To remember that we can change the j-th coordinate at the end of the block we have to use 
a second identical block {j}. Let be the first block, which already exists in the provisional 
transducer. Let (s, t)f be a state in block C. At the end of block we go to block {j} if 
t ■ (s + e mod 2) > and tj = and else to a looping state or to the block 0. If we find out that 
mj ^ u + 1 mod 2 W ~ 1 in block {j}, then we go back to the appropriate state in block 0. At the 
end of block { j} in the state (s, we go to the same states as we would go from the state with 

([u < 2 W - 1 ] ,0)®, _! in the j-th coordinate. 

Up to now we only considered one coordinate. Now we combine this approach for all coordinates. 
Since we have to remember for each coordinate whether we are allowed to change it or not, we 
need one block for every subset of coordinates. Let block C C {1, . . . , d} be the block where we 
can change the coordinates in C. The states in block C are denoted by (s, t, )f. The block is the 
block which already exists in the provisional transducer. The block {1, . . . , d} is not accessible, 
since we need at least one unique coordinate and only non-unique coordinates can be changed. 

If we are in block C ^ and we find out that not every coordinate j e C satisfies nij = u + 1 
mod 2 W ~ 1 , we go to the appropriate state in block C = C \ {j G {l,...,d} \ m,j ^ u + 1 
mod 2 W ~ 1 }. At the end of block C in state (s,t) < ^ > _ 1 we can change the coordinates in C and 
all other coordinates remain the same. Therefore we go to the same states as we would go from 
(s, t)t,-i where Sj = [u < 2 tu ~ 1 ] , t j = for j e C and all other coordinates stay the same, that is 
§j = Sj and tj = tj for j £ C. 

Let (v w -2 ■ ■ ■ Vo) be the binary expansion of v. Further let s, s' , t, t' € {0, l} d , C, C C 
{1, j e {l...d}, i e {l,...,w — 2} and e e {0, l} d . Then altogether there are the 

following transitions in the final transducer: 

e|0 

• s — > s II s = s 

• s (s',i')5 if s ^> (s',i')! is a transition in the provisional transducer 

• (s,t)f (s' ,t')f +l if (s,t)i (s',i') i+ i is a transition in the provisional transducer 
and C — C\ {j : Sj + Ej + k mod 2 ^ Vi} 
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• (s, tf^ s' if t ■ (s + e mod 2) = and s' = [^\ 

• ( s it)w~i ( s ''t')i if £• (s + £ mod 2) > 0, (s, t) w -i (s',i')i is a transition in the 
provisional transducer and C = {j : Sj + £j + Iq mod 2 = Vq and ij = 0} 

• (s, t)^_i — ^> (s', if C* 7^ and (s, — — > (s' , is a transition in this transducer 
with Sj = [it < 2 t0 ~ 1 ] , t, = for j e C and Sj = Sj, t, = t,- for j ^ C 

• ^ s' if C ^ and (s,t)t-i ^ s' is a transition in this transducer with 
Sj = [u < 2 W ~ 1 ] ,tj=0 for j e C and Sj = s^, t } = t } for j ^ C. 

Finally, we restrict the transducer to the states which are actually accessible from the initial 
state. 

It is possible to define similar sequences as in the proof of Theorem [3j but since it requires more 
than one page, we omit it here. □ 

Example 3.2. In Figure [5] there is a sketch of the transducer computing the weight of the AJSF 
over -D-2.3 in dimension two. The labels of the transitions are omitted in the figure and the 
transitions going back at the end of a block or inside a block are gray. We have w — 3, u = (01), 
1= (10) and v = (10). 

An\ {2} A)i\ 

For example the state I ^ I has transitions to the same states as the state I ^ I since 



4. Proof of Theorem Q] 

This section contains the the proof of Theorem [T| which is a generalization of Theorem 6 in [3]. 
With the transducer in Theorem [4] we can compute the asymptotic Hamming weight. Therefore 
we use the following lemma which can be proven by induction on L. 

Lemma 3. Let A , A\ be matrices in C nxn , H : N ->• C nxn be any function and G : N ->• C nxn 
be a function which satisfies the recurrence relation 

G(2N + e) = A E G(N) + sH(N) 

for N > 1 and e G {0, 1}. Then 

\i=a / i=a \j=o J \]=i+i ) 

where we additionally set H(0) = G(l). 

We define /(mi, . . . , m^) := e ith ^ mi ^^' md ' . The matrices M ei) ... )S(i for £ {0, 1} are defined as 
follows: The (A;, Z)-th entry of the matrix M £li ... )EiJ is e lth if there is a transition from state k to 
I with input label (ei, . . . ,Sd) T and output label h. The entry is if there is no transition from 
state k to I with this input label. The ordering of the states is considered to be fixed in such a 
way that the initial state is the last state. Then we have 

L 

(1) r' ,„., M^ A] r 

1=0 

for v T = (0, . . . , 0, 1) and rrii = X)^o m i.i^ ■ The product describes all possible paths from any 
state to any other state, using edges with input labels corresponding to the input (mi, . . . ,m^). 
The exponent of the entries of the matrix product is the sum of output labels on this paths. Since 
we are interested in paths starting and ending in state (0, . . . , 0) T , we multiply by v T from the 
left and v from the right. The factor Mq w ensures that all carries are processed. 
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FIGURE 5. Transducer to compute the Hamming weight of the AJSF in dimension 
two over the digit set D-2,3- 

We further define the following summatory functions 

E(N)= f(mi,...,m d ) 

0<mi,...,m d <N 

F{N)= Yl M{mx,...,m d ), 

0<m 1 ,...,m d <N 

with 

L 

M(mi, . . .,m d ) = JjM mi(Ji ..., mail . 
1=0 

The function M(m\, . . . ,rrid) is 2-multiplicative (cf. By 0, we have 

E(N) = v T F(N)M^ fi v. 
To write down a recursion formula for F(N), we need the following matrices 

e i= 0,l ei =Oei=l 

for disjoint C, D C {1, . . . , d}. The first index C of Bc,r> is the set of coordinates where the digit 
is zero. The second index D is the set of coordinates where the digit is one. All other coordinates 
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in (C U D) c can be any digit. By construction, we have ||M El! ... s J|i = 1, where || • ■ ■ 1^ denotes 
the row sum norm of a matrix. We conclude that ||-Bc,d||i < 2 d ~l c 'H- D l. As a special matrix we 
define A = Bq>$. 

Furthermore we define the functions 

G C (N) := E M{m x ,...,m d ) 

0<mi<N m,i = N 

for every set C C { 1, . . . , d}. 

Then we have F(N) — G^(N) and the functions satisfy the following recursion formulas due to 
2-multiplicativity 

G C {2N)= Z Z Z M(2m 1 +e 1 ,...,2m d + e d ) 

ei=0,l a=0 2mi+ei<2N 2mi+ei=2N 
i<?C i€C igC ieC 

= B cfi G c (N), 



G c (2N+l)= ZEE E M(2m 1 + e 1 ,...,2m d + £ d ) 

Ei=0,l Ei=l 2mi+ei<2N+l 2m;+ei=2jV+l 

= E E E E M : E E M( mi ,...,m d ) 

DCC<= e;=0,l Si =0ei = l 
i^CUD i£D ieC 

E ^d,cGcud{N). 



DCC C £i=0,l Ei=0ei = l m,i<N m i= N 

igCUD i€D ieC igCUD ieCUD 



DCC 

From this recursion we can determine Gc(N) inductively, because all functions Gc> required for 
computing Gq have C D C. Therefore we have the following recursion formula for F(N) — G$(N) 

F{2N + e) = AF(N) + sH(N) 

for N > 1, e e {0,1} and 

H(N) = B D3 G D {N). 

0#DC{l,...,d} 

If we define H(0) — Gg(l), we can use Lemma|3]and get 

(2) F(jr e A=ir ei A'H(jr Sj v 



-i-i 

1=0 / 1=0 \j=l+l 



Thereby H(N) is considered to be a known function because it is a sum of functions Gc(N), 
which are recursively known by Lemma [3] 

From the definition of Gc(N) we can derive the growth rates of the functions Gc(N) and 
H(N). We have ||G c (A)||i = 0{N d -\ c \) and ||#(A0lli = 0(N d - r ). 

Next we investigate the eigenvalues of the matrix A. We first consider the case t = 0. In 
this case, A is the adjacency matrix of the underlying graph of the transducer in Theorem [4] 
Therefore, it has eigenvalue 2 d with eigenvector (1, . . . , 1) T . By the theorem of Perron- Frobenius, 
there is a unique dominant eigenvalue /i(0) of A which is easily seen to be primitive as every state 
is reachable from any other state in exactly Aw steps. As ||^4||i < 2 d and the largest eigenvalue is 
always at most ||^4||i, /i(0) = 2 d is the largest eigenvalue. We denote the modulus of the second 
largest eigenvalue by (3(0). Since eigenvalues are continuous, for t in a suitable neighborhood of 0, 
A has a unique dominant eigenvalue fi(t) and the modulus j3{t) of the second largest eigenvalue 
fulfills /3(i) < \n{t)\. 

Now we want to split up Q into two parts, one for the dominating eigenvalue and one for the 
remaining eigenvalues. Therefore let J = T~ 1 AT be a Jordan decomposition of A where J has been 
sorted such that it has n(t) in the upper left corner. We define A :— Tdiag(^(t) _1 , 0, . . . , 0)T _1 
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and R := T{J - diag(/x(t), 0, . . . , O^T" 1 . Then A 1 = n L A L ~ l + R l holds for I < L. Further we 
define 

oo / z-i 

(3) A(x , Xl ,...) = J2^ l H [J2 x i 2l ~ X ~ j 

1=0 \j=Q 
\l=0 ) 1=0 \j='+l 

The function A is well defined on the infinite product space {0, 1} N because it is dominated by a 
geometric series. We extend A to be a function on [1, 2) by setting A (X^o x i^~ l ) := ^{ x 0i x i, ■ ■ ■) 
with the standard binary expansion and choosing the representation ending on W in the case of 
ambiguity. 

Then we have 



££_!, . . . , £q, 0") + R{sl, . . . , £q) 



and 

E(N) = //(i) 1 ^ w *(log a N, t) + R(N, t), 

with V(x,t) = fi(t)-^v T A(2^)M^ fi v and R(N,t) = v T R(N)M^ s) v. Furthermore there is 
a < 5 < 1 such that log 2 (3(t) < d — 8 in a suitable neighborhood of 0. Then we have 

\R(N,t)\ = 0(N d - s ). 

So we have 

(4) E(N) = N d+ait+a2t2+ °( t3 ^{\og 2 N, t) + 0{N d ~ s ) 

with a\ and a 2 depending on the Taylor expansion of log 2 fj,(t) at t = 0. If we insert t = in Q, 
we obtain tp = *(log 2 N, 0) = 1 + O (N- s ) . 

The function ^(x, t) is periodic in x with period 1 and is well defined for all x £ K + . To prove 
continuity in x we first note that continuity for x £ R with x — log 2 y where y is not a dyadic 
rational follows from (j3J). To prove it for x = \og 2 y with y = X^i £ /2~' a dyadic rational, we 
observe that the two one-sided limits exist due to ([3]). Next we prove that they are the same. 
Therefore we look at the two sequences N k = y2 L+k+1 + 2 k and N k = y2 L+k+1 + 2 k - 1. Then 

lim 2^- N ^ = {e 1 .e 2 ...e L lO UJ ) and lim 2^^ = {e x . e 2 ■ ■ . e L 01 u ). 

k— >oo k— ¥OD 

If we insert these two sequences in ^ we get 

OiN*- 1 ) = E{N k ) - E{N k ) = Ng*()og 2 N k ,t) - JV£*(log 2 N k ,t) + 0(N d - s ), 

and hence limfc_ i . 00 4'({log 2 N k }, t) = lim^oo ^({log 2 iVfc}, i). Therefore *&(x,t) is continuous in 
x. 

In t. ^(x, t) is also continuous, because the eigenvalues of a matrix are continuous. Furthermore 
the function ^(x,t) is arbitrarily often differentiable in f, because it is dominated by a geometric 
series. By the same argument as above, these derivatives are continuous in x. 

The first and second derivative of E{N) with respect to t at t = imply that the expected 
value of the Hamming weight is 

J2 h(m 1 ,...,m d ) = e l ^ d \og 2 N + V 1 (log 2 N)+0(N- s \ogN) 

m,i<N 
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with e lu>d = -ia x log2 and *i(log 2 iV) = -if^(\og 2 N,t)\ t=0 , and 



~ h 2 (m u ..., m d ) = v Uu . d log 2 N + e 2 lud \og 2 2 N + 2e LUid log 2 iV#i(log 2 N) + # 2 (log 2 AO 

+ 0{N- S log 2 N) 



N d 

m.i<N 



with vi ud — — 2a 2 log2 and 4' 2 (log 2 iV) = — ^(log 2 N, t)|t=o- From that we calculate the 



dt 

variance, which is 



jfd £ h 2 (m u ...,m d )- (— ^ h{ 

nii<N \ mi<N 



\ 2 

mi,...,rnd) = 



N d 

m.i<N \ nii<N 

vi, u ,d log 2 N - f 2 (log 2 N) + <f 2 (log 2 AT) + 0(N- S log 2 TV). 
We first compute the characteristic function g_/v(t) of the random variable 

_ h(mi, m d ) - ei, u ,d log 2 N 



which is 



m,i<N 

= e^(l + o(-4^-))i> log 2 N, 



\og 3/2 NjJ \ 2 ' v/^wbg^TV 



+ ttjA AT, — e 

N d \ y/Vi^^Nj 

Since <?at(£) is a characteristic function we have 1 = tpo + tq for ro = -j^R(N, 0) and -0o = 

*(log 2 AT, 0). We know that -^R(N,t) = 0(N~ 5 ). Next we can estimate the difference from 

_ t 2 

QN{t) to the characteristic function f(t) = e~T of the normal distribution with mean and 
variance 1, which is 



IM*) -/(*)! 



log 3 / 2 Nj J V \VWn 



= o 



N d y y/v t , u , d log 2 N 



J exp (-it J^ M rf V /l °g2 N^j ~ ("00 + r )e 2 



for t = o(VBgT?). 

Therefore the Berry-Esseen inequality [5] implies 

™ ^ ■ • ■ . m*) - e i)U , d log 2 N < \ 1 r dy + Q f 1 



\ ^, u , d iog 2 iv y ^ ' Vv/iogA^, 

For a specific digit set and dimension we can compute the constants e^ U:d and v^ U:d explicitly. 
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Example 4.1. We have the digit set D_ 2 ^ in dimension two. See Example 3.2 and Figure [5] for 
the transducer. The adjacency matrix A of the underlying graph of this transducer is 
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The characteristic polynomial of A is 
-(x- l)x 7 (x 2 - 2z) (x 3 - x~ 



xz 



2z) 



7x 3 z - 20x 2 z + 6xz 2 - 24z 2 



At t = the dominating eigenvalue /Lt(0) = 4 is a root of the fourth factor. Therefore the Taylor 
expansion of /i(t) around t = is 



M*) = 4 + 



89 

Hence the expected value of the weight is 

32 



128i 673216 2 , nl , s 
t- t 2 +0(t 3 ). 



2114907 



S!) 



\og 2 N + 0(l) 



and the variance is 



63200 
2114907 



log 2 7V + 0(l). 



In order to determine the constants e^ u .d and Vi tUl d giving mean and variance in general, we 
rephrase the results of the "full-block-length" analysis in |5j in a probability model which is easily 
compared with our main results. 

Lemma 4. Let k > w be a positive integer. Let Wu be the Hamming weight of the AJSF of a 
random vector m — (mi, . . . ,md) T with equidistribution of all vectors m = (mi, . . . ,rrid) T with 
< mi < 2 k . 
Then 

EW k = ei tUld k + 0(1) and YW k = v Lu4 k + 0(Vk) 
for the constants given in Theorem^ 

Proof. For j < k, we denote the j-th digit of the AJSF of a random vector m = (mi, . . . , md) T by 
Xj, where we assume equidistribution of all vectors m = (mi, . . . , md) T with < m., < 2 k . 

In |D § 6.2], the random variables Xj denoting the j-th digit of a random AJSF has been 
considered, where the probability measure was defined to be the image of the Haar measure on 
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the space of (i-tuples of 2-adic integers under the AJSF, i.e.. equidistribution on all residue classes 
modulo 2 l for all I has been assumed. Furthermore, Wj was defined to be the weight of the first 
j digits. _ 

From Algorithm 111 it is clear that Xj only depends on m modulo 2 J+U) . This implies that Xj 
and Xj are identically distributed for j < k — w. Therefore W k —w an d W k - W are identically 
distributed, too. Furthermore, we always have \W k — Wk- W \ < w. 

By Theorem 6.7], we have 

EW k - w = EW k - w = e ltU . d (k -w)+ 0(1) and YW k - w = YW k - w = - w) + (9(1). 

We conclude that 

EW k = EW k ^ w + 0(1) = EW k - w + 0(1) = ei !U<d k + 0{1), 

YW k = VW k - w + Y{W k - W k - W ) + 2 Cov(W k - w ,W k - W k ^ w ) = VW k - w + O(Vfc), 
where the Cauchy-Schwarz inequality has been used in the form 



Cov(W fe _™, W k - W k - W ) < \Jvw k - w V(W k -W k - w ). 



a 



5. Asymptotic distribution of the w-NAF 

In this section we specialize the result of Theorem [T] to the iu-NAF. 

Theorem 5. The weight h(n) of the w-NAF of the integer n with equidistribution on {n € Z 
< ii < N} is asymptotically normally distributed. There exists a S > such that the mean is 

' log 2 N + *i (log 2 N) + 0(N- 5 log N) 



w + 1 

and the variance is 

, 2 -3 1°S2 N - * 2 (log 2 N) + * 2 (log 2 N) + 0(N- S log 2 N), 

where ^ and ^ 2 are continuous, l-periodic functions on R. // w is large enough then 5 = 
log 2 ^1 + ^r^j ■ In particular we have 

1oS2N \ i r i i 

< x = -= / e ~ dy + O 




^\og 2 N V2nJ-oo \\/logN 

for all x E M. 

This follows from Lemma [5] and Theorem [T] 

Lemma 5. The characteristic polynomial of the matrix A of the transducer in Figure [7] is (x — 
l)(x w — x" 1 ^ 1 — 2 w ~ 1 e' t ). The largest eigenvalue /i(i) is unique around t = and /j,(0) = 2. 
Furthermore for large enough w and t — £/iere is exactly one simple eigenvalue in T k — {x G C : 
|ar| > ^ 3 , | arg a; — 2 ^ | < t^} for each k = 0, . . . , w — 1, and additionally the obvious eigenvalue 
x = 1. TTie eigenvalues with the second largest absolute value are in T\ and T w -\. For each 
eigenvalue at t = an expansion in — can &e computed with arbitrarily small error term. 

Proof. The characteristic polynomial of A is obtained by Laplace expansion. With z = - the 
interesting factor of the characteristic polynomial is transformed into z w + z — 2 = 0. The smallest 
root in absolute value of this polynomial is 1, because for \z\ < 1 we have 

\z w + z\ = \z\ ■ {z™- 1 + 1\ < 2\z\ < 2. 

We use the fixed point equation f k (z) = z with 

/*(*) = (2 -zj-e 3 ^ 
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for k = 0, . . . , w — 1. Here we take the main branch of the w-th root. After the substitution we 

< 

enough and \z\ < 1 + ^ we have 



have T fe = {z <E C : \z\ < 1 + ^, | arg z - ^ | < ^} which corresponds to T_ fe mod w . For u; large 



i/;wi = ^|2 



<iri-ir"<-L 



it; V ui / w 
and 

\h{z)\ < \f k (z)-f k (l)\ + \f k (l)\ 

i 2 + — 3 

< -\z-l\ + l< ^ + l<l + _. 

w — 6 w — 6 w 

Furthermore |arg/fc(.~) — < Thus f k {T k ) Q T k and f k is a contraction on T k with 

Lipschitz constant (w — 3) _1 < 1. Therefore there exists a unique fixed point of f k in T k for each 
fc. Because T k for fc = 0, . . . , w — 1 only intersect in 0, which is certainly no root of the polynomial, 
we found w distinct roots of the polynomial z w +z — 2, so we found all roots of this polynomial. We 
only have to investigate < k < because the coefficients of the polynomial are real. Let z € T k 
be the fixed point of f k . For p = exp(^) we have \z — p k \ = O(^). Therefore z = p k + O(^). 
For k < w a with a fixed ^ < a < 1 we have 

„. , 2irik m ( k 2 
z = f(z) = l+ +0' 



Iterating, we successively get 

2irik 2-r 2 fc 2 2nik , , .. . 

z = l-\ ^ — + O ( — ) and 

it; it;- 

4^ 2 fc 2 ,/fc 3 
ur \it; 4 

Therefore for large it; only the fixed points for fc = w — 1,0, 1 are in the the disk {z € C : |z| < 
1 + ^}. 

•UJ'i J 

For & > ic a we have 



\2-p k \ = ^5 -4 cos (-^)V > (5-4cos(2u;^ 1 7r))^ 
= 1+4^W"- 2 + 0(u; 4q - 4 ), 

|2-z|>|2-p fc |-k-/l 

= 1 + 47r 2 u; 2a - 2 + 0(w 4a - 4 + w' 1 ), 

\f k (z)\ = exp f i log |2 - > 1 + 4tt 2 w 2q - 3 + ©(w 4 "" 5 + uT 2 ). 

in 2 

Thus for k > w a the fixed point of f k is not in the disk {z 6 C : |z| < 1 + for large u>. □ 
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